Version 1.1Effective 2 October 2026

Highlighted items in square brackets are details still to be confirmed by the platform operator.

Privacy Policy

Version: 1.1 Effective: 2 October 2026

This policy explains how [LEGAL ENTITY NAME] (NZBN [NZBN]) ("we", "us", "our"), the operator of NZ Backyard (nzbackyard.com) (the "Platform"), collects, uses, shares, stores and protects personal information, and how you can exercise your rights. We are bound by the Privacy Act 2020 and its Information Privacy Principles. Our privacy officer can be reached at [PRIVACY OFFICER EMAIL].

This policy is written to describe what the Platform actually does. Where a feature is built but switched off, or planned but not built, we say so.

1. Who we are and how to contact us

• Operator: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], New Zealand.
• General enquiries and requests: [SUPPORT EMAIL].
• Privacy officer: [PRIVACY OFFICER EMAIL].

2. What information we collect, and why

We collect only what a feature needs. The table lists each kind of information, where it comes from, and the purpose.

We do not collect financial account numbers, card details, government identifiers (such as passport or driver-licence numbers), or health information as fields of the Platform. Documents you upload may contain such information about you or others; section 4 explains your responsibilities.

Information you do not have to give. You may use the Platform without giving optional information, but some features need certain details: an agent cannot host an open home without an agency, a viewing cannot be booked, requested, accepted or checked in to without a mobile number and a budget, because both go to the listing agency with the email address on your account (section 7), and a professional profile cannot be register-checked without a registration number.

3. Cookies, local storage, analytics and device information

• Session cookies. Our authentication provider (Supabase) sets a cookie that keeps you signed in. It is essential; without it the Platform cannot know who you are.
• Local storage. Your browser keeps a few preferences on your device: whether you have seen the onboarding tour, your theme choice, and a calendar preference. They contain no personal information beyond an account identifier and never leave your device.
• Analytics and advertising. We do not use analytics tools, advertising cookies, tracking pixels or third-party scripts on the Platform at the date of this policy. If that changes, this policy will be updated first and any non-essential cookies will require your consent.
• Device and log information. Our hosting provider records standard server logs (see section 8). We do not fingerprint devices.

4. Uploaded documents and third parties' information

Documents you upload will often contain personal information about third parties — people other than you: the registered owners on a record of title, a vendor's name in an agreement, a neighbour's address in a LIM, a prior occupant's circumstances in an inspection or meth report, or people named in body corporate minutes.

• You are responsible for having the right to upload and share each document, including the personal information in it. Do not upload a document you have no authority to share, and do not share it more widely than you are entitled to.
• We treat documents as confidential to the case. Documents are held in private storage; they can be opened only by the uploader and the people the uploader shares them with (as "view" or "download"), by every buyer with a live case on the property where the uploader has published a "property pack", and — after settlement — by a buyer whose entitlement to keep reading certain documents was recorded. Access is checked on every request. See section 7 for AI processing.
• We do not read your documents except where you ask for an AI assessment (section 6), where you ask us to help with a support issue, or where the law requires.
• If you believe a document containing your information has been uploaded without authority, contact [PRIVACY OFFICER EMAIL]. We will investigate and, where appropriate, remove it and tell the uploader.

Notice to people whose information is in a document (Information Privacy Principle 3A). From 1 May 2026 the Privacy Act requires an agency that collects personal information indirectly to take reasonable steps to make the individual aware of it. When someone uploads a document naming you, we do not usually have any way to contact you, and the document was typically obtained lawfully for the transaction you are already part of (for example, a title or LIM obtained by a buyer of your property). This policy, and the notice printed on every shared document, are the practical steps we take. If you are a party to a transaction on the Platform and want to know what documents naming you are held, ask us.

5. How we use information

We use personal information only for the purposes in section 2 and for purposes directly related to them:

• providing, securing and supporting the Platform;
• telling you about activity on your account and cases (invitations, document shares, viewing changes, tasks) — these are service messages, sent in-app today; email or SMS delivery of them, if added, will be described here first;
• checking professional registration numbers against public registers, and marking profiles with the result and the date;
• investigating abuse reports, security incidents and breaches of the Terms and Conditions;
• meeting our legal obligations, including record-keeping, responding to lawful requests, and handling copyright and harmful-content notices;
• marketing only with your consent: we send product news and updates by email only if you have ticked the separate marketing box (which is never pre-ticked). You can withdraw at any time from your account, by the unsubscribe link in any such email, or by emailing [SUPPORT EMAIL]. Service messages about your account and cases are not marketing and continue regardless.

We do not sell personal information. We do not use your information, documents or messages to train artificial-intelligence models, and our AI provider does not use them to train its models (section 6).

6. AI document assessment (built, switched off)

The Platform contains an AI document assessment feature. It is switched off at the date of this policy and can be used only by accounts we have expressly enabled it for. When it is available to you, it works only on your explicit request and only on one document at a time. Before you use it, you must read and acknowledge the AI Document Assessment Notice.

When you request an assessment:

• the full document file (and its file name) is sent to our AI provider, [AI PROVIDER] — at the date of this policy, Anthropic PBC (Claude API), a company in the United States;
• processing happens outside New Zealand: in the United States, or wherever the provider's global routing selects unless we have pinned a region ([AI PROCESSING REGION]);
• the provider's commercial terms provide that it does not use content sent through its API to train its models, and that it holds the content under its data-processing terms as our processor;
• the provider retains the document and the output for up to 30 days under its standard terms, and may retain content its safety systems flag for longer (up to two years); a zero-retention arrangement exists for some models by agreement — our current arrangement is [AI RETENTION PERIOD];
• we store the resulting structured summary alongside the document, readable only by the people who can read the document, until the document is deleted;
• we do not store any extracted text of the document, and we do not use the document or the output for any other purpose.

Nothing you upload is sent to the AI provider unless you press the button that requests an assessment for that document.

6A. Payment information (no payments are taken yet)

No payment provider is connected and no paid feature is switched on at the date of this policy. If we introduce a paid feature, payments will be processed by a third-party payment provider ([PAYMENT PROVIDER]): you will enter your card or bank details into the provider's own secure form, and the provider — not us — will hold them under its own privacy policy. We will receive only confirmation that a payment was made, the amount, the last four digits of the card, and the provider's reference, which we keep with your account for receipts, refunds and our records. We will not receive or store your full card number or security code. The Payment and Refund Policy explains what you will be told before any charge.

7. Who we share information with

We share personal information only as described here.

Other people on the Platform

• Case participants (the buyer or seller who owns a case and the people they invite — agent, lawyer, mortgage broker, builder or inspector) see each other's name and role, the case's stage and timeline, tasks, offers recorded on the case, messages in threads they belong to (from the time they joined), and documents shared with them.
• Listing agents, and the other members of their agency, see for the properties their agency lists: who has registered for or booked a viewing (your name, the mobile number on your profile, the email address on your account, the budget you gave, and whether you attended), registrations of interest and any message you send with them, the stage your case is at and how you found the listing, private viewing requests, and whether you responded "interested" or "not for me" after a viewing (your private notes are never shared). An agency keeps that information in its list of people interested in the property after the viewing. Where more than one agency has listed the same property, each can see interest messages sent about it. They do not see who is privately tracking a property. Booking a viewing shares your name, mobile number, email address and budget with the listing agency. This happens when you book an open home, accept an agent's invitation to a viewing, request a private viewing or check in with a QR code, and the agency uses these details to follow up with you about its properties. If you have asked us to hide your contact details, the agency does not see your mobile number or email address. You can change your budget at any time in Account settings; a booking you have already made keeps the budget you had when you made it.
• Buyers with a live case on a property see documents an agent or seller has published to the property pack.
• Service providers in the directory see the enquiries you send them, your name and any attachments. Provider listings, including photos and logos, are public.
• People you invite receive the invitation you send; your name appears as the inviter.

Service providers that process information for us (our processors, also called subprocessors)

These providers hold information on our behalf under written data-processing terms and may not use it for their own purposes. None of them is in New Zealand; section 9 covers overseas processing.

Sources we obtain information from, who are not our processors

• Google — if you use Google sign-in, Google provides your email, name and picture URL and knows you signed in to the Platform. For service-provider ratings, we send Google Places the provider's Google Place identifier (not anything about you) and display the rating with Google's attribution; we do not store ratings.
• Trade Me — if you import a listing, we send Trade Me the listing identifier and receive the listing's property facts. Nothing about you is sent to Trade Me.

Authorities and legal requirements

We disclose personal information where the law requires or permits it: to comply with a court order, warrant or lawful request by a New Zealand agency; to the Privacy Commissioner; to enforce our Terms or protect the rights, property or safety of any person; or in connection with a sale or restructure of our business (in which case this policy continues to apply and you will be told).

We never disclose the identity of a person who makes a harmful-content complaint, or of an author, except with consent or by court order (Harmful Digital Communications Act 2015).

8. How long we keep information

We keep personal information only as long as it is needed for the purpose it was collected for, or as the law requires.

A defined retention schedule beyond the above has not yet been set; the placeholders will be replaced when it is. Information may persist for a short period in provider backups after deletion.

9. Information stored or processed outside New Zealand

None of our providers is located in New Zealand. Your information is stored in Australia (Supabase, Zoho) and processed in the United States and, for the AI provider, in the United States or elsewhere as its routing selects (sections 6 and 7). Each provider holds the information as our agent under data-processing terms that require it to protect the information and not use it for its own purposes; we remain responsible for it under the Privacy Act 2020. Australia and the United States do not have privacy laws that the New Zealand Privacy Commissioner has prescribed as comparable, so we rely on those contractual protections. By using the Platform you acknowledge this overseas storage and processing; if you are not comfortable with it, please do not upload documents or use the AI assessment.

10. Security

• Documents and files are held in private storage and opened only through short-lived signed links issued after an access check on every request.
• Access rules are enforced in the database (row-level security), not only in the interface.
• Passwords are stored as one-way hashes. Sessions use secure, HTTP-only cookies.
• QR check-in codes carry only an opaque, expiring, revocable token — never personal or property information.
• Data is encrypted in transit, and our storage and database provider encrypts data at rest.
• Platform administrators cannot open your private documents or messages; their actions are audited.
• We use security headers and size limits on requests, and error messages never reveal database detail.

No system is perfectly secure. We do not scan uploaded files for malware at the date of this policy, and we do not guarantee backups of uploaded files (section 8) — keep your own copies of important documents.

11. Access and correction

You may ask for a copy of the personal information we hold about you, and ask us to correct it, by emailing [PRIVACY OFFICER EMAIL]. We will respond within 20 working days. If we do not agree to a correction, you may ask us to attach a statement of the correction you sought. There is no charge for a reasonable request. We will need to verify your identity before releasing information.

12. Deleting your account

There is no self-service account deletion at the date of this policy. To close your account, email [SUPPORT EMAIL] from your account address. We will:

• delete your profile, consents, preferences and sign-in identity;
• remove documents you uploaded into your own cases, and remove your access to everything else;
• keep records that other participants in a case reasonably need, or that the law requires us to keep (for example, consent evidence, audit records and transaction records), for the retention period in section 8, and then delete them;
• remove your personal information from provider backups as those backups expire.

Documents you uploaded into another person's case, documents a buyer is entitled to keep after settlement, and messages you sent, may remain in that case because they form part of the other participants' record of the transaction; where we cannot remove an item we will tell you, and we will remove your name from it where the record allows. Tell us if you believe a particular item should be removed.

13. Notifiable privacy breaches

A notifiable privacy breach is one that has caused, or is likely to cause, serious harm. If one occurs, we will notify the Privacy Commissioner and the affected people as soon as practicable, as the Privacy Act 2020 requires, and tell them what happened, what information was involved, what we are doing, and what they can do. Our providers are contractually required to notify us of breaches affecting our data (Anthropic and Supabase within 48 hours; others without undue delay).

14. Complaints

If you have a concern about how we have handled your information, contact our privacy officer at [PRIVACY OFFICER EMAIL] or write to [REGISTERED ADDRESS]. We will acknowledge your complaint within 5 working days and aim to resolve it within 20 working days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

15. Children

The Platform is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a child has created an account, contact us and we will remove it.

16. Changes to this policy

We will update this policy when our practices change. Each version is numbered and dated at the top. Where a change is material — for example, a new provider that receives your documents, a new purpose, or a new overseas location — we will ask you to read and accept the new version before you continue using the Platform, and we will keep a record of the version you accepted.